Junglewise Threat Intelligence

CVE-2024-35896: Linux Kernel Netfilter out-of-bounds read in setsockopt

CVE-2024-35896 · Severity: high · CVSS 7.1 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Netfilter component, which manages network traffic filtering and firewall rules. A local attacker could exploit this flaw to cause a system crash or potentially access sensitive information from the computer's memory. This issue primarily affects older versions of the kernel and has been addressed in recent security updates.

Technical details

An out-of-bounds read vulnerability exists in the Linux kernel Netfilter component (specifically within ip_tables.c). The root cause is a failure to validate the 'optlen' argument in the setsockopt() system call before copying data from a socket pointer. This allows a local attacker to trigger a slab-out-of-bounds read via the do_replace or do_ipt_set_ctl functions. The vulnerability was exposed by recent BPF optimizations that changed how memory is allocated for socket options. Exploitation can lead to a kernel panic (DoS) or the leakage of kernel memory. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.12 to 5.10

Timeline

  • 2024-04-04: patched: Initial fix committed to mainline kernel
  • 2024-05-19: disclosed: CVE published

References

Related threats